diff --git a/nix/host-modules/deploy.nix b/nix/host-modules/deploy.nix
index d89a1e7d..4b881ea3 100644
--- a/nix/host-modules/deploy.nix
+++ b/nix/host-modules/deploy.nix
@@ -69,10 +69,6 @@ in
       [ "services" "hyperhive" "swarm" "controller" "enable" ]
       [ "services" "hyperhive" "deploy" "swarm-controller" "enable" ]
     )
-    (lib.mkRenamedOptionModule
-      [ "services" "hyperhive" "swarm" "controller" "socketPath" ]
-      [ "services" "hyperhive" "deploy" "swarm-controller" "socketPath" ]
-    )
     (lib.mkRenamedOptionModule
       [ "services" "hyperhive" "swarm" "controller" "forgeTokenFile" ]
       [ "services" "hyperhive" "deploy" "swarm-controller" "forgeTokenFile" ]
diff --git a/nix/host-modules/swarm-controller.nix b/nix/host-modules/swarm-controller.nix
index 42ac308d..d3f12383 100644
--- a/nix/host-modules/swarm-controller.nix
+++ b/nix/host-modules/swarm-controller.nix
@@ -447,6 +447,7 @@ in
     socketPath = lib.mkOption {
       type = lib.types.str;
       default = "/run/swarm-controller/controller.sock";
+      readOnly = true;
       description = ''
         Unix socket the daemon serves on, and the path the gateway's nginx
         proxies to.
diff --git a/nix/module-eval.nix b/nix/module-eval.nix
index 7c819347..b0b26984 100644
--- a/nix/module-eval.nix
+++ b/nix/module-eval.nix
@@ -201,13 +201,12 @@ let
     deploy.matrix.maxRequestSize = 99000000;
   };
 
-  # `enable` is spelled the OLD way like everything else here, so all seven
-  # of the controller's shims are exercised rather than six.
+  # `enable` is spelled the OLD way like everything else here, so all six
+  # of the controller's shims are exercised rather than five.
   controllerOldPath = hive {
     swarm.controller.enable = true;
     swarm.controller.package = pkgs.emptyDirectory;
     swarm.controller.swarmctlPackage = pkgs.emptyDirectory;
-    swarm.controller.socketPath = "/run/test-ctrl/ctrl.sock";
     swarm.controller.forgeTokenFile = "/run/secrets/ctrl-forge.token";
     swarm.controller.authBridgeUrl = "http://127.0.0.1:19097";
     swarm.controller.queue.clientSecretFile = "/run/secrets/ctrl-queue.secret";
@@ -962,19 +961,25 @@ let
       # Reads the host's tmpfiles rules, not the options: the socket directory
       # nginx and the container share is created there, so a rename that
       # resolved but stopped reaching the module would leave the gateway
-      # proxying to a path nothing creates. All four old paths are defined in
-      # the fixture, so removing any single shim fails the eval rather than
-      # only the one this assertion reads.
-      # All FOUR movers are asserted as rendered effects rather than as option
-      # values, so a rename that resolved but stopped reaching the module is
-      # caught per-option instead of only where one assertion happens to look.
+      # proxying to a path nothing creates. All three old paths are defined
+      # in the fixture, so removing any single shim fails the eval rather
+      # than only the one this assertion reads.
+      # THREE movers (authBridgeUrl, forgeTokenFile, queue.clientSecretFile)
+      # are asserted as rendered effects rather than as option values, so a
+      # rename that resolved but stopped reaching the module is caught
+      # per-option instead of only where one assertion happens to look.
+      # socketPath is no longer one of them: it went readOnly and lost its
+      # shim in the same slice, so it has no pre-rename path left to prove
+      # reaches the unit — the SOCKET line below instead pins the one value
+      # it can ever hold, the default, so the env var vanishing or being
+      # misspelled still fails this arm.
       name = "a config written against the pre-rename swarm-controller paths still reaches the unit";
       ok =
         let
           u = controllerOldPath.systemd.services.swarm-controller;
           creds = u.serviceConfig.LoadCredential;
         in
-        u.environment.SWARM_CONTROLLER_SOCKET == "/run/test-ctrl/ctrl.sock"
+        u.environment.SWARM_CONTROLLER_SOCKET == "/run/swarm-controller/controller.sock"
         && u.environment.SWARM_CONTROLLER_AUTH_BRIDGE_URL == "http://127.0.0.1:19097"
         && lib.any (c: lib.hasInfix "/run/secrets/ctrl-queue.secret" c) creds
         && lib.any (c: lib.hasInfix "/run/secrets/ctrl-forge.token" c) creds;